As reported by The Hacker News, active exploitation attempts are targeting CVE-2026-81648, a CVSS 10.0 vulnerability in the CryptoPayment Gateway WordPress plugin. The flaw enables unauthenticated attackers to delete arbitrary files, overwrite gateway configuration, and extract stored wallet credentials in cleartext. No patch exists. The plugin has been pulled from the WordPress Plugin Directory, but any site still running it is fully exposed.

Security Impact: As reported by The Hacker News, active exploitation attempts are targeting CVE-2026-81648, a CVSS 10.0 vulnerability in the CryptoPayment Gateway WordPress plugin.

Vulnerability Summary

AttributeDetail
CVECVE-2026-81648
CVSS10.0 (Critical)
Affected ProductCryptoPayment Gateway WordPress plugin
Affected Versions1.2.1 – 1.2.2 (latest)
Vendor PatchNot available
Plugin StatusClosed on WordPress Plugin Directory (as of Aug 28, 2026)
Active ExploitationYes — confirmed by Defused Cyber
Attack VectorUnauthenticated AJAX endpoint missing authorization checks

Why This Matters

This vulnerability is a worst-case scenario for any WordPress site processing cryptocurrency payments. The missing authorization check on an administrative AJAX endpoint means an attacker needs no credentials whatsoever — just network access to the site. The ability to recover wallet credentials in cleartext converts a website compromise directly into financial theft. Worse, arbitrary file deletion can be weaponized to disable security plugins, wipe audit logs, or destroy core WordPress files to create a persistent backdoor condition.

The attack infrastructure observed by Defused Cyber — marketed as

Anonymous KYC-Free VPS Hosting
— is a telltale indicator of abuse-friendly hosting providers commonly used by cybercriminals for automated WordPress scanning and exploitation. This is not a targeted attack; it is opportunistic mass exploitation.

Who Is at Risk

Why This Matters
Any WordPress site with the CryptoPayment Gateway plugin installed in versions 1.2.1 or 1.2.2
E-commerce sites or donation platforms accepting cryptocurrency through this gateway
Sites where wallet credentials (private keys, API keys, seed phrases) were stored in plugin configuration
Organizations lacking WAF rules or AJAX endpoint monitoring for anomalous unauthenticated requests

Broader Implications

This case underscores a systemic WordPress ecosystem problem: plugins that handle financial transactions can be pulled from the directory with no patch, leaving installed instances permanently exposed. The download statistics (1,845 total downloads) suggest a small install base, but even a single compromised wallet could result in catastrophic, irreversible financial loss. Cryptocurrency transactions cannot be reversed — there is no chargeback or fraud department to call.

It also highlights the danger of storing cryptographic secrets within WordPress plugin configuration at all. CMS plugins are among the most frequently vulnerable components in the web application stack, and they should never be trusted as key management systems.

Shield53 Recommendations — Immediate Actions

Step 1: Remove the Plugin Immediately

Deactivate and delete the CryptoPayment Gateway plugin from every WordPress instance. There is no patch and no workaround. Retention equals exposure.

Step 2: Rotate All Wallet Credentials

Assume compromise. Rotate private keys, API keys, wallet seed phrases, and any shared secrets that were configured in the plugin. Move all associated wallets to new, uncompromised keys. Monitor blockchain activity for unauthorized transactions.

Step 3: Audit for Compromise

  • Review WordPress core files and other plugin files for unauthorized modifications or deletions
  • Check server access logs for unauthenticated POST requests to /wp-admin/admin-ajax.php with unusual action parameters
  • Scan for newly created administrator accounts or modified wp-config.php
  • Inspect file integrity monitoring (FIM) alerts for the period the plugin was active

Step 4: Implement Preventive Controls

  • Deploy WAF rules blocking unauthenticated AJAX requests to non-public plugin endpoints
  • Adopt a secrets manager (HashiCorp Vault, AWS Secrets Manager) for any cryptographic keys — never store them in CMS configuration
  • Subscribe to vulnerability feeds for all installed WordPress plugins and establish a 48-hour SLA for critical patch response
  • Implement network-level restrictions on wp-admin and admin-ajax.php where feasible

Step 5: Detection Rule (Apache/Nginx Log Hunting)

Search access logs for patterns indicating exploitation attempts:

  • POST requests to admin-ajax.php from non-authenticated sessions (no valid WordPress auth cookie)
  • Requests referencing cryptopayment action parameters
  • Requests from hosting providers associated with anonymous or abuse-friendly VPS services

Treat any match as a presumptive compromise requiring full incident response procedures.